CZ.NIC is preparing the introduction of the NSEC3 security technology

From today, ISPs in the Czech Republic can test NSEC3, a new version of the DNSSEC technology, on their DNS resolvers.

Prague, 4 June 2010 – From today, Internet access providers in the Czech Republic can test NSEC3, a new version of the DNSSEC technology, on their DNS resolvers. Therefore, the CZ.NIC Association, the administrator of the .CZ top level domain, published the plan for the introduction of this security system into the .CZ domain and ENUM. The first step consists in testing NSEC3 in both zones (.CZ, ENUM). For Czech ENUM domains, this phase will run until 15 June when NSEC3 will go live in ENUM. In the .CZ zone, the new security system will be launched on 3 August, i.e. after the planned signature of the root zone with the DNSSEC technology.

„When introducing the DNSSEC technology in the autumn 2008, we decided to deploy this security technology in the variant called NSEC, which is a part of the DNSSEC specification. NSEC records have an undesirable property, though. Because of the ordering of records, it is fairly easy to obtain the contents of the whole zone with the right combination of queries on NSEC records. This is why we decided to launch NSEC3 as soon as possible, also because it makes it impossible to obtain domain information this way,” explained Ondřej Filip, Executive Director of the CZ.NIC association.

More information about deploying the NSEC3 technology in the .CZ and ENUM zones is available at http://www.nic.cz/nsec3/. Besides a detailed explanation of how NSEC3 works, you can find a schedule that the CZ.NIC association will follow.